Hello,
below is an ipt_LOG output from kernel 2.6.33.2:
May 3 15:14:40 intratest kernel: REJECT IN=eth0 OUT=
MAC=02:00:00:00:00:29:00:0c:76:28:3e:6c:08:00 SRC=172.16.1.1 DST=172.16.1.145 ...
The MAC address really looks strange if you take
the original data into consideration:
Source: 172.16.1.1 (00:0C:76:28:3E:6C)
Destination: 172.16.1.145 (02:00:00:00:00:29)
The corresponding code in net/ipv4/netfilter/ipt_LOG.c:
ipt_log_packet():
if (in && !out) {
/* MAC logging for input chain only. */
printk("MAC=");
if (skb->dev && skb->dev->hard_header_len
&& skb->mac_header != skb->network_header) {
int i;
const unsigned char *p = skb_mac_header(skb);
for (i = 0; i < skb->dev->hard_header_len; i++,p++)
printk("%02x%c", *p,
i==skb->dev->hard_header_len - 1
? ' ':':');
} else
printk(" ");
The current code does the following:
- Output the two MAC addresses separated by ":"
instead of something readable like " "
- Output the destination MAC address first which
is a bit unexpected as the first shown IP is
the IP address of "SRC".
Idea: Maybe print "MACSRC= " and "MACDST= ". Leave out
the "MACxxx= " output if the MAC address is not known.
- Output "08:00" garbage at the end.
Could it be that "skb->dev->hard_header_len" is longer
than the MAC address header field?
Cheers,
Thomas
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
